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Abstract 

Space vehicle propulsion systems are traditionally comprised of a cluster of 
discrete engines, each with its own set of turbopumps, valves, and a thrust 
chamber. The Integrated Modular Engine (IME) concept proposes a vehicle 
propulsion system comprised of multiple turbopumps, valves, and thrust 
chambers which are all interconnected. The IME concept has potential 
advantages in fault-tolerance, weight, and operational efficiency compared 
with the traditional clustered engine configuration. The purpose of this 
study is to examine the steady-state performance of an IME system with 
various components removed to simulate fault conditions. An IME 
configuration for a hydrogen/oxygen expander cycle propulsion system with 
four sets of turbopumps and eight thrust chambers has been modeled using 
the ROCket Engine Transient Simulator (ROCETS) program. The nominal 
steady-state performance is simulated, as well as turbopump, thrust chamber 
and duct failures. The impact of component failures on system performance 
is discussed in the context of the system’s fault tolerant capabilities. 


Glossary of Terms 

AETB Advanced Expander Test Bed Engine 
FTP Fuel Turbopump 
FPDM Fuel Pump Discharge Manifold 
FTBV Fuel Turbine Bypass Valve 
FTDM Fuel Turbine Discharge Manifold 
HXDM Cooling Jacket Discharge Manifold 
LOX Liquid Oxygen 
MTBV Main Turbine Bypass Valve 
OTP Oxidizer Turbopump 
OPDM Oxygen Pump Discharge Manifold 
OTDM Oxidizer Turbine Discharge Manifold 
TC Thrust Chamber Assembly 

$ Pump Flow Coefficient 

<t> suU Pump Flow Coefficient at onset of Stall 
(<l> at maximum Head Coefficient) 


Introduction 

Historically, most American rocket propulsion 
systems have been comprised of one or more 
discrete engines, each with its own set of pumps, 
turbines, valves, and a thrust chamber. The 
engines in such a configuration are not tightly 
interconnected but work separately. Recently, a 
different propulsion concept has been suggested 
wherein the system is composed of a common 
set of turbopumps, valves and thrust chambers, 
all interconnected by manifolds. This 
configuration is referred to as an Integrated 
Modular Engine (IME). The IME concept offers 
potential advantages in reliability, cost and 
weight. Each of these advantages must be 
verified carefully before resources are committed 
to developing such a system. 


stems primarily from its fault tolerant capability. 
In the traditional cluster of discrete engines, 
when a major component of an engine fails, the 
entire engine must be shut down, including those 
components which have not failed. In an IME 
system, it may be possible to shut-off a failed 



component without requiring the shutdown of other 
system components. To be considered truly fault 
tolerant, the IME system should be capable of 
maintaining full thrust despite a component failure. 
This would require that operation of the other 
components in the system be adjustable to 
compensate for the loss of the failed component. 

The feasibility of fault tolerant operation has not 
previously been explored in detail. Although 
propulsion systems in which multiple thrust 
chambers operate from common turbopumps have 
been flown before (the Atlas boost stage and a 
number of Russian vehicles), these systems use 
integrated system designs for reasons other than fault 
tolerance. The fault tolerance of such integrated 
designs has never been demonstrated. The purpose 
of the modeling effort discussed in this paper is to 
provide quantitative information about the operation 
of an IME system when various components are lost. 
A statistical analysis of IME reliability is presented in 
a separate paper, i 

A steady-state system model of an IME has been 
created using the Rocket Engine Transient Simulator 
(ROCETS) program. ROCETS is a general purpose 
system modeling code capable of both steady-state 
and transient simulation.* The IME configuration 
modeled here is a cryogenic hydrogen/oxygen 
expander cycle made up of four fuel turbopumps, 
four oxygen turbopumps, and eight regeneratively 
cooled thrust chambers (Figure 1). The system is 
designed to provide a nominal thrust of 80,000 Ibf 
(35586 N). The basic configuration of the system is 
similar to those proposed in previous studies 3 to 
provide a basis for comparison. The thrust level was 
selected to meet anticipated upper stage application 
requirements. The number of combustion chambers 
(eight) was selected to provide adequate thrust 
balance in the event of component failure. The 
number of turbopump sets (four) was selected to take 
advantage of the exisiting component designs 
generated in the Advanced Expander Test Bed 
(AETB) program. 4 Component redesign and 
analysis were performed, when necessary, at NASA 
Lewis using steady-state component computer 
codes. 5 * 6 

Using this model of the IME, the effects of 
component failure on system operation are 
calculated. The failures considered include loss of 
fuel and/or oxidizer turbopumps, loss of thrust 
chambers, and leaks in the various distribution 
manifolds. The computer model is used to predict 
the changes in system operation that are required to 
maintain desired thrust despite component failure. 
The resultant changes in pump stall-margins and 
throttling capacity observed in the model will help 
assess the fault-tolerance of this IME system. The 
results of this study also provide important 


information for further component design 
iterations to improve system fault-tolerance. 
Descriptions of the component and system 
models are presented below, followed by a 
discussion of the analysis results. 

Description of IME Model 

The IME system design depicted in Figure 1 is 
based on a study being conducted at NASA 
Lewis Research Center to determine methods for 
physically assembling an IME J This design is a 
full-expander cycle, which means that the total 
hydrogen fuel flow passes through the nozzle 
and chamber cooling jackets. The warmed 
hydrogen is used to drive the turbopumps, and is 
then injected into the combustion chamber. The 
IME design in Figure 1 implements full-expander 
operation as follows. Liquid hydrogen from the 
tanks is supplied to the four fuel pumps in 
parallel. The fuel pumps discharge into a 
manifold (FPDM), which feeds the eight parallel 
cooling jackets. The cooling jacket flows are 
collected in the next manifold (HXDM) and 
distributed to the four parallel fuel turbines, 
which drive the fuel pumps. The fuel turbine 
discharge flows are then collected in a third 
manifold (FTDM) and distributed to the four 
parallel oxidizer turbines, which drive the LOX 
pumps. Finally, the fuel is collected once more 
(in the OTDM) and distributed to the eight thrust 
chambers. The oxidizer follows a much less 
circuitous route, flowing from the tank(s) 
through the four parallel LOX pumps and into 
the OPDM. The oxidizer is then distributed to 
the eight thrust chambers. Each turbopump and 
thrust chamber assembly in the system has 
associated inlet and exit shut-off valves, which 
isolate that component from the rest of the 
system in the event of a failure. Li addition to 
the shut-off valves, there are two system control 
valves. The main turbine bypass valve (MTBV) 
is used to control system thrust level. The fuel 
turbine bypass valve (FTBV) is used to maintain 
LOX pump discharge pressures at low thrust 
levels. In its present configuration, the system is 
not designed to control thrusts in the eight 
chambers independently. This differential 
throttling capability could be accomplished, if 
desired, by replacing the fuel and oxidizer 
injector shut-off valves with control valves 
instead. This would, however, increase the 
complexity of the controller logic and the valve 
actuator system. 

Each fuel turbopump (Figure 2) has three pump 
stages and two turbine stages. The first-stage 



fuel turbine drives the first-stage fuel pump (shaft 1), 
while the second-stage turbine drives the second and 
third stage pumps (shaft 2). Each oxidizer 
turbopump (Figure 3) consists of a single turbine 
driving a single LOX pump. The nozzle cooling 
circuit is made up of tubular channels while the 
chamber employs milled channels closed off by a 
metal skin. The LOX injector uses a dual orifice 
design similar to that used in the AETB.< 

All valves and ducts in the system, with the 
exception of the fuel shut-off valves and fuel 
injectors, are modeled with non-inertial 
incompressible flow correlations. The distribution 
manifolds are represented as simple non-resistive 
volumes. Pump performances are represented as 
tables, or maps , of head coefficient and efficiency 
versus flow coefficient.* Turbine performances are 
represented as bivariate maps of flow parameter 
(related to resistance) versus pressure ratio and 
reduced speed*, and by maps of efficiency versus 
velocity ratio.* The maps for the first stage fuel 
pump and the LOX pump are the same as those used 
for the AETB system, while the second and third 
stage fuel pump maps and all turbine maps have been 
redesigned. 5 - « The design changes were necessary 
because the IME is a full-expander cycle while the 
AETB is a split-expander (where a large fraction of 
the fuel flow from the first stage pump is bypassed 
around the cooling jackets and turbines). Chamber 
and nozzle performances are based on empirical 
tables and equations relating chamber pressure, 
propellant flow, mixture ratio, and thrust. Cooling 
jacket performance is calculated using Bartz 
correlations for the hot-side heat transfer 9 and using 
Colburn correlations for the cool-side transfer.'^ 
Although the sizes and shapes of the IME chambers 
and nozzles have been changed from those in the 
AETB, that model’s nozzle performance and heat- 
transfer correlations can still be applied. 

The model is solved under the ROCETS system 
using an iterative Newton-Raphson matrix solver.^ 


Results of Analysis 

In this study, the effects of various component 
failures on system performance are examined. Ten 
scenarios were considered in all: 

Test Case 1 : Nominal case - all components 
operating normally 

Test Case 2 : Single fuel turbopump out (when a 
fuel pump fails, the associated turbine is also shut 
down, and vice versa). 


Test Case 3 : Single oxidizer turbopump out 
(when a LOX pump fails, the associated turbine 
is also shut down, and vice versa). 

Test Case 4 : One fuel turbopump AND one 
oxidizer turbopump out. 

Test Case 5 : Two thrust chambers (with cooling 
jackets) out. It as assumed that if a single thrust 
chamber fails, the opposing chamber must be 
shut off to balance vehicle thrust. The same will 
be true in a cluster of discrete engines. 

Test Case 6 : A 5% flow leak in Fuel Pump 
Discharge Manifold (FPDM). 

Test Case 7 : A 5% flow leak in Heat Exchanger 
(cooling jacket) Discharge Manifold (HXDM). 


Test Case 8 : A 5% flow leak in Fuel Turbine 
Discharge Manifold (M UM). 

Test Case 9 : A 5% flow leak in Oxidizer Turbine 
Discharge Manifold (OTDM). 

Test Case 10 : A 5% flow leak in Oxygen Pump 
Discharge Manifold (OPDM). 


Each of the above scenarios was investigated at 
High and Low thrust levels. The High thrust 
level of 80000 lbf (10000 lbf per chamber) was 
selected to provide approximately 9% turbine 
bypass while operating as close as possible to the 
turbomachinery design conditions. The Low 
thrust level of 29600 lbf (3700 lbf per chamber) 
was determined as the nominal minimum thrust 
before the potential onset of stall in the second 
stage fuel pump (the first to stall). The stall point 
is defined here by the zero slope point on head 
vs. flow map for each pump. In this study, the 
turbine bypass valves are varied to maintain 
desired system thrust in spite of the component 
failures ( closed-loop control ). Failed 
components are isolated from the rest of the 
system using shut-off valves, located upstream 
and downstream of each component. 

For each of the above listed failure cases, two 
indicators of system response are considered. 

The first indicator is the amount of bypass flow 
around each turbine cluster required to maintain 
the High thrust level. Decreased turbine bypass 
margins limit the ability of the system to provide 
higher-than-rated thrust excursions for 
emergency throttling and mission aborts. The 
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second indicator of system response is the pump stall 
margin, defined here as 

Stall Margin = (<t> - 4 > slall ) ' kuii 

where $ is the pump flow coefficient 8 for each 
scenario at the Low thrust level, and ^ is the flow 
coefficient at which stall may occur in each pump. 
When the is below <t» suUI , the operation of the pump 
may become unstable. 

Tables la and lb summarize key system performance 
parameters for the Nominal test case at High and 
Low thrusts respectively. Table 2 shows the 
changes from nominal in several parameters for the 
system’s closed-loop response to the failure cases 
described above. These changes are expressed as 
percentages of the nominal values. 

Figure 4 shows the main turbine bypass andfuel 
turbine bypass flows for each scenario at High 
thrust, depicted in a histogram format. Turbine 
bypass margin is not a limiting factor at Low thrust 
for these failure cases. 

Figure 5 shows the second-stage fuel pump stall 
margins at Low thrust for each scenario. The 
second stage fuel pump is highlighted here because it 
stalls first in each case, and will therefore be the 
limiting factor. Pump stall is not a problem at High 
thrust for these failure cases. 

Figures 6a, b, and c show the system operating 
points, plotted on the performance maps for the first 
stage fuel pump, the combined second and third 
stage fuel pumps, and the LOX pump respectively. 
The operating points for both High and Low thrust 
levels are shown, numbered according to test case. 
These figures graphically depict the changes in pump 
operation from nominal (Case 1) for the various 
failure scenarios. 

Discussion of Results 

The first observation made during this study was that 
an FTB V is required as well as the MTBV, even for 
a healthy system, in order to maintain desired LOX 
injector pressure drops at lower thrusts. Adequate 
injector delta-P is necessary to ensure that thrust 
chamber pressure oscillations do not propagate back 
into the system. The injector delta-P also helps 
atomize the LOX for better mixing of propellants in 
the thrust chamber. In the n omin al High thrust 
condition for the system, the FTBV is closed, but 
must be opened in order to throttle the system to 
points below 68000 lbf thrust. Both MTBV and 


FTBV are required to accommodate component 
failures at all thrust levels. Even so, the 
combination of MTBV and FTBV used here is 
not always adequate to accommodate component 
failures, as is discussed below. 

Consider the effects of component failures on 
system performance at the High thrust level 
(80000 lbf total system thrust). As shown in 
Figure 4, the failure of a single LOX turbopump 
will prevent the system from operating at full 
thrust, despite attempts to compensate using the 
turbine bypass control valves. With one LOX 
turbopump shut-off, the maximum system thrust 
will decrease to 62000 lbf. Note also that while 
the system cannot maintain 100% thrust with a 
single LOX turbopump out, it can accommodate 
the loss of a LOX turbopump in combination 
with the shut-down of a fuel turbopump. It may 
be advantageous, therefore, to pair the fuel and 
LOX turbopumps and remove the intervening 
FTDM ring manifold. This would, however, 
require separate fuel turbine bypass valves for 
each turbopump pair. Removing both 
turbopumps in this case also drives the remaining 
LOX turbopumps to dangerously high shaft 
speeds, as illustrated in Figure 6c (Case 4). 
Rotor-dynamic stability limitations may preclude 
the option of shutting down a turbopump pair 
and maintaining full-thrust in this configuration. 
An alternative solution to accommodate this type 
of fault is to redesign the system control strategy, 
using independent fuel turbine and LOX turbine 
bypass valves (instead of the MTBV and FTBV). 
Additional simulations have shown that 
independent turbine bypasses allow the system to 
maintain full thrust in the event of a LOX 
turbopump failure, without shutting down other 
components. 

The shut-down of two thrust chambers is another 
case where the desired High thrust cannot be 
maintained by altering turbine bypass flows. 
Furthermore, when two thrust chambers are shut- 
off, it is not possible to attain even 75% of the 
desired system thrust (maintaining healthy 
chambers at their nominal high thrusts). In fact, 
the system cannot maintain the desired LOX 
injector delta-P for thrusts above 42000 lbf, and 
the pumps will be in danger of stalling for thrusts 
only slightly lower than 42000 lbf. Thus there is 
only a narrow range of thrusts around 53% 
where the system will maintain stable operation. 
The loss of two thrust chambers can be 
accommodated (at 75% system thrust) if a fuel 
and a LOX turbopump are also shut-off, but this 
negates the fault tolerance of the IME. 
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Summary and Concluding Remarks 


Figure 4 indicates that relatively small leaks in the 
distribution manifolds (5% of the inlet flow) can be 
accommodated at High thrust levels. Leaks in the 
FPDM or HXDM do, however, cause significant 
decreases in the turbine bypass margin. 

Furthermore, it has been found that a 10 % flow leak 
in either of these two manifolds cannot be 
accommodated at High thrust In addition to 
performance degradation, leaks in the manifolds will 
produce serious safety concerns. The manifolds in 
the IME configuration are not redundant and 
therefore represent a potential single-point failure 
mode for the system. i 

As mentioned previously, the potential onset of 
pump stall has been used to define the Low thrust 
level (29600 lbf total system thrust). This study 
therefore assumes a nominal stall margin of only 
about 1 % to begin with. As seen in Figure 5, most 
of the component failure cases actually drive the fuel 
pumps away from stall. This is true because these 
failures increase the flow rates through the operating 
fuel pumps without a proportionate rise in required 
discharge pressures. The failure of a single LOX 
turbopump or a leak in the OPDM will cause a small 
decrease in the fuel pump stall margin, since these 
failures increase the load on the fuel pumps without 
increasing the fuel pump flows. By far the most 
severe problem with stall comes from the shut-down 
of two thrust chambers, which decreases the flows in 
all pumps while requiring them to keep the same 
discharge pressures. This condition drives all pumps 
into the stall region at Low thrust. For thrust 
chamber failure, the nominal stall margin can be 
maintained at the Low thrust level if a pair of fuel and 
LOX turbopumps are shut-off as well. 

These results suggest that an IME propulsion system 
based on a full-expander cycle may have limited fault- 
tolerant capabilities. It may not be possible to 
accommodate the loss of a turbopump or thrust 
chamber by altering the operation of die remaining 
components. This study has indicated that the 
magnitude of change required to accommodate 
component failures may well be beyond the capacity 
of the remaining components, or may lead to stall or 
rotor-dynamic instabilities. Although system designs 
based on an expander cycle are simple and involve 
temperatures and pressures which place less strain on 
components, a more powerful cycle, using gas 
generators for example, may be more fault tolerant 
It may also be possible to improve the system fault 
tolerance by using a larger number of redundant 
components; the loss of a given component will place 
less of a load on the surviving components (see also 
Ref.l). Alternative configurations such as these 
should be examined using system models as well. 


A computer model has been created using the 
ROCETS code in order to study the steady-state 
performance of an IME rocket propulsion 
system. The IME configuration chosen for this 
study is a full-expander cycle comprised of eight 
thrust chambers, four fuel turbopumps and four 
LOX turbopumps. Using the model, the effects 
of several failure scenarios on system 
performance have been examined. Given the 
present designs of the turbomachinery and other 
components, several limitations have been noted 
regarding the IME system fault tolerance. In the 
IME system modeled here, failure of a LOX 
turbopump or thrust chamber cannot be 
accommodated at full-thrust. The impacts of 
these failures on system performance can be 
mitigated by shutting down other, unfailed 
system components. Removing healthy 
components to accommodate failures, however, 
negates the potential advantages in fault-tolerance 
for the IME over discrete engines. The model 
indicates that this IME system can accommodate 
small leaks (5% of flow) in the distribution 
manifolds. With the exception of a thrust 
chamber failure, the scenarios simulated here do 
not appear to significantly increase the threat of 
stall at low thrust levels; in most cases, the 
failures actually reduce the likelihood of stall. 

No attempt has been made here to assess the 
threat of pump cavitation. 

This simulation study has provided some 
important information regarding the failure 
response of one IME configuration. Although 
this study has indicated that the IME may not be 
as fault-tolerant as previously believed, it would 
be premature to suggest that the IME concept is 
unworkable based on these results alone. It may 
yet be possible to redesign the components or 
system to improve fault tolerance; these 
simulation results can, in fact, be used to guide 
such design efforts. This study also highlights 
the utility of system modeling for conceptual 
design of space propulsion systems. 
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Discharge Temperature (R) 684.96 670.19 Discharge Temperature (R) 669.68 

Mass Flow (Ibm/sec) 1.218 1.218 Mass Row (ibm/sec) 1.594 

Shaft Speed (rpm) 40804 40213 Shaft Speed (rpm) 2021 1 

Torque (Ibf-in) 130.55 145.42 Torque (Ibf-in) 194 

Power (HP) 84.52 92.78 Power (HP) 62.2 



Table 2 : IME Closod-loop Failure Response at Hkjht Thrusl 
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Note 1 - Because FTBV is closed In Nominal Case, a direct comparison cannot be made lor the fault cases where FTBV Is open. 
Instead, FTBV flow Is compared to the MTBV flow of the Nomina! Case to obtain a percent value. 

Note 2 - The system cannot achieve the desired thrust per chamber because there Is Insufficient turbine flow to provide power. 

Note 3 - The second stage fuel pump Is operating at a point where stall Is likely to occur. 






FIGURE 1 : INTEGRATED MODULAR ENGINE (IME) SCHEMATIC DIAGRAM 
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Figure 6a - 1st Stage Fuel Pump Ma| 
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Figure 6c - LOX Pump Map 
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